Security alert apis (#8)

* tinkering with GHAS alert-related APIs
* working on basic scripts to pull security alerts

.github/workflows/ghas-feature-checker.yml

@@ -0,0 +1,74 @@
+
+# This workflow is designed to run on demand only.
+# See the repos API for more information: https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28
+# A repository secret named GH_PAT is required to run this workflow. It must have the "security_events" read permission.
+# If any check fails, the workflow will exit with a non-zero status.
+name: "Check Security Features"
+
+on:
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Dependabot
+        id: check_dependabot
+        run: |
+          echo "Checking if Dependabot is enabled..."
+          DEPENDABOT=$(curl -s -H "Authorization: Bearer ${{ secrets.GH_PAT }}" https://api.github.com/repos/${{ github.repository }}/dependabot/alerts)
+          echo "Dependabot response: $DEPENDABOT"
+          if [[ -z "$DEPENDABOT" ]] || [[ "$DEPENDABOT" == "null" ]]; then
+            echo "Dependabot is not enabled"
+            exit 1
+          else
+            echo "Dependabot is enabled"
+          fi
+
+      - name: Check Secret Scanning
+        id: check_secret_scanning_features
+        run: |
+          echo "Checking if Secret Scanning is enabled..."
+          REPO_SETTINGS=$(curl -s -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GH_PAT }}" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/${{ github.repository }})
+          SECRET_SCANNING=$(echo "$REPO_SETTINGS" | jq -r '.security_and_analysis.secret_scanning.status')
+          SECRET_SCANNING_PUSH_PROTECTION=$(echo "$REPO_SETTINGS" | jq -r '.security_and_analysis.secret_scanning_push_protection.status')
+          echo "Secret Scanning status: $SECRET_SCANNING"
+          echo "Secret Scanning Push Protection status: $SECRET_SCANNING_PUSH_PROTECTION"
+          if [[ "$SECRET_SCANNING" != "enabled" ]]; then
+            echo "Secret Scanning is not enabled"
+            exit 1
+          fi
+          if [[ "$SECRET_SCANNING_PUSH_PROTECTION" != "enabled" ]]; then
+            echo "Secret Scanning Push Protection is not enabled"
+            exit 1
+          fi
+
+      - name: Check Code Scanning Analyses
+        id: check_code_scanning_analyses
+        run: |
+          echo "Checking if Code Scanning Analyses are present..."
+          CODE_SCANNING_ANALYSES=$(curl -s -L -H "Accept: application/vnd.github.v3+json" -H "Authorization: Bearer ${{ secrets.GH_PAT }}" https://api.github.com/repos/${{ github.repository }}/code-scanning/analyses)
+          TOOLS=$(echo "$CODE_SCANNING_ANALYSES" | jq -r '[.[] | .tool.name] | unique')
+          echo "Tools: $TOOLS"
+          if [[ "$TOOLS" == "[]" ]] || [[ "$TOOLS" == "null" ]]; then
+            echo "No tools found in Code Scanning Analyses"
+            exit 1
+          else
+            echo "Tools found in Code Scanning Analyses"
+          fi
+
+      - name: Final Report
+        run: |
+          if [[ "${{ steps.check_dependabot.outcome }}" == "failure" ]]; then
+            echo "Dependabot check failed"
+          fi
+          if [[ "${{ steps.check_secret_scanning_features.outcome }}" == "failure" ]]; then
+            echo "Security features check failed"
+          fi
+          if [[ "${{ steps.check_code_scanning_analyses.outcome }}" == "failure" ]]; then
+            echo "Code Scanning Analyses check failed"
+          fi
+          if [[ "${{ steps.check_dependabot.outcome }}" == "success" ]] && [[ "${{ steps.check_secret_scanning_features.outcome }}" == "success" ]] && [[ "${{ steps.check_code_scanning_analyses.outcome }}" == "success" ]]; then
+            echo "All checks passed. Good job!"
+          fi
+

ghas-scan.py

@@ -5,7 +5,7 @@
 
 # Set the GitHub owner type, owner name, and personal access token
 owner_type = 'user'  # Options are 'org' or 'user'
-owner_names = ['austimkelly']
+owner_names = ['swell-consulting']
 
 # Get the access token from the environment variable
 access_token = os.environ.get('GITHUB_ACCESS_TOKEN')
@@ -67,7 +67,7 @@
     writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
     writer.writeheader()
 
-    print("Fetching repo security configs... (this may take a while))")
+    print(f"Fetching repo security configs for {owner_name} . . . (this may take a while))")
     for repo in all_repos:
         repo_details = get_repo_details(repo['owner']['login'], repo['name'], headers)
 
@@ -88,7 +88,12 @@
     print(f"CSV file '{csv_filename}' written successfully.")
 
     with open(csv_filename, 'r') as csvfile:
-        print_aggregated_metrics_from_csv(csvfile)
+        lines = csvfile.readlines()
+        if len(lines) <= 1:
+            print(f"ERROR: File {csv_filename} is empty or only contains headers")
+        else:
+            print_aggregated_metrics_from_csv(csvfile)
+
         csvfile.close()
 
 # Get the end time

ghas_scan_helpers.py

@@ -195,6 +195,7 @@ def get_repo_details(owner, repo_name, headers):
     # If the repository was not found, log the repository name and owner and return None
     if response.status_code == 404:
         print(f"Repository {repo_name} of owner {owner} not found. It will be skipped.")
+        print(f"Response: {repo_info}")
         return None
 
     # Print the repo_info dictionary
@@ -284,7 +285,7 @@ def get_repos(owner, headers, owner_type, skip_forks=False):
     if owner_type == 'user':
         repos_url = f'https://api.github.com/users/{owner}/repos'
     elif owner_type == 'org':
-        repos_url = f'https://api.github.com/orgs/{owner}/repos'
+        repos_url = f'https://api.github.com/orgs/{owner}/repos?type=internal'
     else:
         raise ValueError("Invalid owner type. Use 'user' or 'org'.")
 

pull_all_security_alerts/examples/advisories.csv

@@ -0,0 +1,80 @@
+ghsa_id,cve_id,url,html_url,summary,description,severity,author,publisher,state,created_at,updated_at,published_at
+GHSA-897j-wghw-fjcx,CVE-2021-44228,https://api.github.com/repos/austimkelly/swiss-cheese/security-advisories/GHSA-897j-wghw-fjcx,https://github.com/austimkelly/swiss-cheese/security/advisories/GHSA-897j-wghw-fjcx,Supply Chain Advisory: log4j (Demonstration Purposes Only),"### Impact
+_What kind of vulnerability is it? Who is impacted?_
+
+log4j dependency is out of date. See also GitHub advisory: https://github.com/advisories/GHSA-v57x-gxfj-484q
+
+### Patches
+_Has the problem been patched? What versions should users upgrade to?_
+
+Per the CVE (https://nvd.nist.gov/vuln/detail/CVE-2021-44228), clients should update to 2.17.1 of the log4j dependency immediately. There has been multiple incomplete fixes. See https://github.com/advisories/GHSA-v57x-gxfj-484q for details on the various patch attempts
+
+### Workarounds
+_Is there a way for users to fix or remediate the vulnerability without upgrading?_
+
+Disabling lookups via Environment Variable
+Setting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS=true .
+This option is the easiest to apply for containerized environments.
+
+Disabling lookups in log4j2 configuration
+Another good option since there is no need to replace JARs or no need to modify logging configuration file, users who cannot upgrade to 2.17.0 can mitigate the exposure by:
+
+Users of Log4j 2.10 or greater may add -Dlog4j2.formatMsgNoLookups=true as a command line option or add -Dlog4j2.formatMsgNoLookups=true in a log4j2.component.properties file on the classpath to prevent lookups in log event messages.
+Users since Log4j 2.7 may specify %m{nolookups} in the PatternLayout configuration to prevent lookups in log event messages.
+As an example; users deploying Hazelcast Management Center via helm charts can do the following to disable lookups and restart in one command:
+
+helm upgrade <release-name> hazelcast/hazelcast --set mancenter.javaOpts=""<javaOpts> -Dlog4j2.formatMsgNoLookups=true""
+
+Where is the release name and is existing java options user has added previously.
+
+Removing the JndiLookup from classpath
+Remove the JndiLookup and JndiManager classes from the log4j-core jar. Note that removal of the JndiManager will cause the JndiContextSelector and JMSAppender to no longer function.
+
+### References
+_Are there any links users can visit to find out more?_
+
+Please see Dependabot PRs:
+
+* https://github.com/austimkelly/swiss-cheese/pull/17
+
+Associated Dependabot alerts for this PR can be found in: https://github.com/austimkelly/swiss-cheese/security/dependabot?q=is%3Aopen+log4j
+",critical,austimkelly,austimkelly,published,2024-01-10T18:22:00Z,2024-01-10T18:24:31Z,2024-01-10T18:24:31Z
+GHSA-x2j5-6fv4-fxc2,CVE-2023-26492,https://api.github.com/repos/austimkelly/swiss-cheese/security-advisories/GHSA-x2j5-6fv4-fxc2,https://github.com/austimkelly/swiss-cheese/security/advisories/GHSA-x2j5-6fv4-fxc2,SSRF found in ssrf.py (This is just a demo of a security advisory),"## Summary
+
+This is only a demo for an advisory. This uses existing CVE and CWE Ids to avoid requesting a CVE from GitHub.
+
+### References
+
+* https://github.com/advisories - Github Security Advisory Database
+* https://docs.github.com/en/code-security/security-advisories - Working with Security Advisories
+
+### Impact
+_What kind of vulnerability is it? Who is impacted?_
+
+SSRF vulnerability detected in python source code.
+
+## Source Reference
+
+https://github.com/austimkelly/swiss-cheese/blob/main/ssrf/ssrf.py#L10
+
+We also have a code scanning reference here: https://github.com/austimkelly/swiss-cheese/security/code-scanning/4
+
+## Reproducible
+
+1. In `/ssrf` run `python3 ssrf.py`
+2. Run http://127.0.0.1:5000/follow?url=https://api.github.com/events in your browser.
+3. If the `url` parameter is executed, fail.
+
+### Patches
+_Has the problem been patched? What versions should users upgrade to?_
+
+A code update has not yet been provided.
+
+### Workarounds
+_Is there a way for users to fix or remediate the vulnerability without upgrading?_
+
+At this point there does not appear to be a mitigation without fixing and deploying the offending code
+
+### References
+_Are there any links users can visit to find out more?_
+",high,austimkelly,austimkelly,published,2024-01-10T13:59:24Z,2024-01-10T14:53:21Z,2024-01-10T14:53:21Z